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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address ~ 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

• Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)S Responsive to communication(s) filed on 26 November 2004 . 
2a)S This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-20 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) I3 Claim(s) 1-20 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 1 1 9 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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3) S Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 5 ) D Notice of Informal Patent Application (PTO-152) 
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DETAILED ACTION 

1 . This action is responsive to communications filed 26 November 2004. This 
action is made FINAL . 

2. Claims 1-20 remain pending. 

Claim Rejections - 35 USC § 103 

3. The text of those sections of Title 35, U.S. Code not included in this action can 
be found in a prior Office action. 

4. Claims 1-3, 6, 8-11, 14, and 16-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Soha (U.S. 4,817,080), hereinafter referred to as Soha, in view of 
Smith, R. N. et al. ("Operating Firewalls Outside the LAN Perimeter"), hereinafter 
referred to as Smith. 

5. As per claims 1 and 9, Soha discloses a method of collecting statistics at a 
plurality of measurement points (col. 4, lines 23-31 and lines 41-43). Soha discloses 
the use of multiple monitor units in order to collect statistics and keep track of traffic flow 
(col. 4 lines 37-45). Soha discloses a method of statistics collection, but is silent on the 
statistics analysis in order to reconstruct a path taken by undesirable network traffic. 
However, Smith discloses a method of blocking undesirable network traffic (p. 496, col. 
2, paragraph 4, lines 1-10). The reconstruction of a path taken by undesirable network 
traffic through the network is considered a method used to block unwanted traffic from 
getting to its destination. It would have been obvious to one of ordinary skill in the art at 
the time of applicant's invention to block undesirable network traffic based on network 
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statistics. It is for this reason that one of ordinary skill in the art would have been 
motivated to implement Smith's network unwanted traffic blocking method using a 
statistics collection mechanism disclosed by Soha. 

6. As per claims 2 and 10, in accordance with claims 1 and 9, respectively, Soha 
discloses a network, but is silent on the blocking of undesirable network traffic. 
However, Smith discloses the blocking of undesirable network traffic within a computer 
network (p. 496, col. 2, para. 4, lines 1-10). One with ordinary skill in the art at time of 
applicant's invention would have found it advantageous to use the method disclosed by 
Smith in accordance with the network disclosed by Soha in order to block undesirable 
network traffic. It is for this reason that one of ordinary skill in the art would have been 
motivated to use the network traffic blocking method disclosed by Smith in accordance 
with the network disclosed by Soha. 

7. As per claims 3 and 1 1 , in accordance with claims 1 and 9, respectively, Soha 
discloses a network, but is silent on the use of a router. However, Smith discloses the 
use of routers in the forwarding infrastructure (p. 493, col. 2, para. 2). It would have 
been obvious to one of ordinary skill in the art at the time of applicant's invention to use 
a router configuration similar to the one disclosed by Smith in accordance with the 
network disclosed by Soha. It is for this reason that one of ordinary skill in the art would 
have been motivated to use routers in a forwarding infrastructure. 

8. As per claims 6 and 14, in accordance with claims 1 and 9, respectively, Smith 
discloses a method of receiving upstream statistics by way of a backward trace (p. 497, 
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col. 1, para. 1 , lines 6-9). Smith also discloses the method of using this information to 
redirect or block the path of the undesirable network traffic (p. 496, col. 2, para. 4). 

9. As per claims 8 and 16, in accordance with claims 1 and 9, Soha discloses the 
use of a computer network, but is silent on whether or not the computer network is 
involved with the Internet. However, Smith discloses a computer network associated 
with the Internet (p. 493, col.1 , para. 1 ). It would have been obvious to one of ordinary 
skill in the art at the time of applicant's invention to use the Internet as the computer 
network as disclosed by Smith in accordance with the statistics gathering network 
method disclosed by Soha. It is for this reason that one of ordinary skill in the art would 
have used the Internet as the computer network. 

10. As per claims 17 and 19, in accordance with claims 1 and 9, respectively, Smith 
discloses undesirable network traffic including denial of service attacks (p. 494, col. 2, 
para. 6 -p. 495, col. 1). 

11. As per claims 18 and 20, in accordance with claims 17 and 19, respectively, it 
would be obvious to one of ordinary skill in the art for the computer network to have 
service providers. It is deemed inherent for a computer network to have service 
provider networks. 

12. Claims 4, 5, 7, 12, 13, and 15 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Soha (U.S. 4,817,080), hereinafter referred to as Soha, in view of 
Smith, R. N. et al. ("Operating Firewalls Outside the LAN Perimeter"), hereinafter 
referred to as Smith, and in further view of Phaal (U.S. 5,315,580), hereinafter referred 
to as Phaal. 
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13. As per claims 4 and 12, in accordance with claims 1 and 9, respectively, Soha 
discloses the use of a network monitoring system in order to gather statistics, but does 
not disclose specific examples of statistics gathered. However, Phaal discloses a 
similar network-monitoring device that collects statistics, including flow-based statistics 
(col. 6, line 48 - col. 7, line 2). It would have been advantageous to one of ordinary skill 
in the art at the time of applicant's invention to gather statistics based on network flow. 
It is for this reason that one of ordinary skill in the art would have found it obvious and 
would have been motivated to gather flow-based statistics. 

14. As per claims 5 and 13, in accordance with claims 1 and 9, respectively, Soha 
discloses the use of packet statistics, but is silent on the use of packet statistics 
providing information about a set of packets. However, Phaal discloses packet statistics 
gathering including information about packets entering the network (col. 6, lines 48-61). 
It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to utilize the packet statistics method disclosed by Phaal because there are 
many types of statistics that can be derived from a single packet (col. 6, lines 48-51). It 
is for this reason that one of ordinary skill in the art would have been motivated to utilize 
the packet statistics gathering method disclosed by Phaal. 

15. As per claims 7 and 15, in accordance with claims 1 and 9, respectively, Smith 
teaches the method of reconstructing a path taken by undesirable network traffic, but is 
silent on extracting profiles from statistics collection. However, Phaal discloses a 
method of creating profiles from statistics collected by using a traffic matrices (col. 6, 
line 62 - col. 7, line 2) that can be available for analysis (col. 6, lines 44-47). It would 
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have been obvious to one of ordinary skill in the art at the time of applicant's invention 
to extract profiles in the form of traffic matrices in order to determine how to redirect 
undesirable network traffic. It is for this reason that one of ordinary skill in the art would 
have been motivated to utilize the traffic matrices disclosed by Phaal to assist in 
reconstructing a path taken by undesirable network traffic. 

Response to Arguments 

16. Applicant's arguments filed 26 November 2004 have been fully considered but 
they are not persuasive. 

17. (A) Applicant argues, "...Soha does not collect statistics at a plurality of 
measurement points located within routing and forwarding infrastructure of a computer 
network." 

18. As to point (A), the applicant's argument is not persuasive. Soha clearly 
discloses in column 2 lines 15-26 and column 4, lines 23-31 and lines 41-43 the ability 
to collect statistics at multiple locations within a computer network. A plurality of 
network monitors are used in multiple locations of the network herein referred to as the 
"routing and forwarding infrastructure." 

19. (B) Applicant argues, "...Smith is not concerned with analyzing statistics in order 
to reconstruct a path taken by undesirable network traffic through a computer network 
from a source of the traffic." 

20. As to point (B), the applicant's argument is not persuasive. The examiner does 
not depend upon Smith to analyze statistics that have been gathered, but merely the 
method of blocking, in this case "reconstructing a path taken by undesirable network 
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traffic," through a computer network from a source of the traffic. The method of blocking 
unwanted network traffic in a computer network is clearly disclosed by Smith on pg. 
496, column 2, paragraph 4, lines 1-10. 

21 . THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Benjamin A Ailes whose telephone number is (571)272- 
3899. The examiner can normally be reached on M-F 7:30-5, First Friday Off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jack B Harvey can be reached on (571)272-3896. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-21 7-91 97 (toll-free)A 





Benjamin Ailes 
Art Unit 2142 
Patent Examiner 



